AZ-200 Azure Security & Identity 2 — Questions and Answers
Question 1: What is an Azure AD application registration used for in development?
- Registering virtual machines in Azure AD
- Representing an application in Azure AD to enable authentication and authorization via OAuth2/OIDC (Correct answer)
- Creating user accounts for the app
- Configuring network security groups
Correct answer: Representing an application in Azure AD to enable authentication and authorization via OAuth2/OIDC
An app registration creates an identity for an application in Azure AD, enabling it to authenticate users or other services using OAuth2 and OpenID Connect protocols.
Question 2: Which Azure AD token type should be validated by a resource API to authorize incoming requests?
- ID token
- Refresh token
- Access token (Correct answer)
- SAML assertion
Correct answer: Access token
An API should validate the access token, which is issued by Azure AD and contains the caller's identity, roles, and scopes for authorization decisions.
Question 3: What is the purpose of Azure AD Conditional Access policies for application developers?
- Automatically scale apps based on user load
- Enforce additional security requirements (MFA, compliant device) when accessing applications (Correct answer)
- Generate API keys for applications
- Configure user roles in the application
Correct answer: Enforce additional security requirements (MFA, compliant device) when accessing applications
Conditional Access policies enforce security requirements like MFA or compliant device when users sign into applications, protecting against compromised credentials.
Question 4: How should a developer rotate a secret stored in Azure Key Vault with zero downtime?
- Update the secret value and restart the app immediately
- Create a new secret version, update the app to read the new version, then deactivate the old version (Correct answer)
- Delete the old secret and create a new one
- Use a double-secret approach with manual code toggle
Correct answer: Create a new secret version, update the app to read the new version, then deactivate the old version
Best practice is to create a new version of the secret in Key Vault, deploy the application with the new version reference, then disable the old version after validation.
Question 5: What Azure feature allows developers to verify that a request comes from a specific Azure service without checking credentials?
- Service Tags in network security groups
- Managed Identity with Azure AD token validation (Correct answer)
- IP allowlisting only
- API key rotation
Correct answer: Managed Identity with Azure AD token validation
Using managed identity, a service obtains an Azure AD access token that the receiving service can validate cryptographically to confirm the caller's identity.
Question 6: Which Azure service provides centralized secrets management with HSM-backed key storage and audit logging?
- Azure Information Protection
- Azure Key Vault (Correct answer)
- Azure Confidential Computing
- Azure Dedicated HSM only
Correct answer: Azure Key Vault
Azure Key Vault provides a centralized, cloud-hosted vault for secrets, keys, and certificates with optional HSM backing, RBAC, and full audit logging via Azure Monitor.
AZ-200 Azure Security & Identity 2
What is an Azure AD application registration used for in development?